syzbot

------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 10337 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
Modules linked in:
CPU: 1 PID: 10337 Comm: syz-executor.3 Not tainted 5.12.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:refcount_warn_saturate+0x169/0x1e0 lib/refcount.c:25
Code: 09 31 ff 89 de e8 a7 30 b0 fd 84 db 0f 85 36 ff ff ff e8 ba 28 b0 fd 48 c7 c7 60 ad be 89 c6 05 9f 17 ef 09 01 e8 53 57 ff 04 <0f> 0b e9 17 ff ff ff e8 9b 28 b0 fd 0f b6 1d 84 17 ef 09 31 ff 89
RSP: 0018:ffffc90000508bb8 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88801e57a0c0 RSI: ffffffff815bb195 RDI: fffff520000a1169
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815b423e R11: 0000000000000000 R12: ffff88806e655800
R13: ffff8880094d80c0 R14: 0000000000000000 R15: ffff888079a70000
FS:  0000000000000000(0000) GS:ffff88802cb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f199cb701fb CR3: 00000000141e0000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_add include/linux/refcount.h:199 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 in6_ifa_hold include/net/addrconf.h:425 [inline]
 ipv6_get_ifaddr+0x487/0x530 net/ipv6/addrconf.c:2028
 ndisc_send_rs+0x17f/0x6f0 net/ipv6/ndisc.c:671
 addrconf_rs_timer+0x3f2/0x820 net/ipv6/addrconf.c:3877
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1431
 expire_timers kernel/time/timer.c:1476 [inline]
 __run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1745
 __run_timers kernel/time/timer.c:1726 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1758
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu kernel/softirq.c:422 [inline]
 irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x25/0x40 kernel/locking/spinlock.c:199
Code: 0f 1f 44 00 00 55 48 8b 74 24 08 48 89 fd 48 83 c7 18 e8 6e b7 52 f8 48 89 ef e8 e6 6c 53 f8 e8 e1 d0 72 f8 fb bf 01 00 00 00 <e8> d6 68 47 f8 65 8b 05 cf 9c fb 76 85 c0 74 02 5d c3 e8 2b f2 f9
RSP: 0018:ffffc900019d75c8 EFLAGS: 00000202
RAX: 00000000000069f1 RBX: 0000000000000001 RCX: 1ffffffff1b8c459
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff88802cb35240 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff817923f8 R11: 0000000000000000 R12: ffff88802cb35240
R13: ffff888020e781c0 R14: 0000000000000000 R15: ffff88801e57a0c0
 finish_lock_switch kernel/sched/core.c:4076 [inline]
 finish_task_switch.isra.0+0x158/0x7e0 kernel/sched/core.c:4193
 context_switch kernel/sched/core.c:4327 [inline]
 __schedule+0x914/0x21a0 kernel/sched/core.c:5075
 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:5235
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35
 __raw_spin_unlock include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock+0x36/0x40 kernel/locking/spinlock.c:183
 spin_unlock include/linux/spinlock.h:394 [inline]
 zap_pte_range mm/memory.c:1332 [inline]
 zap_pmd_range mm/memory.c:1380 [inline]
 zap_pud_range mm/memory.c:1409 [inline]
 zap_p4d_range mm/memory.c:1430 [inline]
 unmap_page_range+0xf98/0x2650 mm/memory.c:1451
 unmap_single_vma+0x198/0x300 mm/memory.c:1496
 unmap_vmas+0x16d/0x2f0 mm/memory.c:1528
 exit_mmap+0x2a8/0x590 mm/mmap.c:3218
 __mmput+0x122/0x470 kernel/fork.c:1082
 mmput+0x58/0x60 kernel/fork.c:1103
 exit_mm kernel/exit.c:501 [inline]
 do_exit+0xb0a/0x2a60 kernel/exit.c:812
 do_group_exit+0x125/0x310 kernel/exit.c:922
 get_signal+0x42c/0x2100 kernel/signal.c:2773
 arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:811
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x148/0x250 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x465f69
Code: Unable to access opcode bytes at RIP 0x465f3f.
RSP: 002b:00007f46bcfa7188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: 0000000000000003 RBX: 000000000056bf60 RCX: 0000000000465f69
RDX: fffffdffffffffff RSI: 0000000000000000 RDI: 00000000200003c0
RBP: 00000000004bfa67 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffd9330220f R14: 00007f46bcfa7300 R15: 0000000000022000